rutster/fuzz/README.md

fuzz/ — cargo-fuzz harness directory (placeholder)

Status: placeholder. Not yet a cargo-fuzz project — just the directory.

ADR-0007 abolished the first-party SIP parser (the original reason this directory was pre-paved), so the original sip_parser / sdp_parser fuzz targets are gone from the plan. The hostile-byte surfaces that do exist post-0007, and that the harnesses here will eventually target, are:

• Tap protocol frames (crates/rutster-tap/src/protocol.rs) — the WS framing between the core and an external brain. This is hostility surface #1 today: a brain is an untrusted process and its frames cross the FOB boundary. Slice-2 ships this surface without a fuzzer; the harness should land as soon as third-party brains exist (P6 of the 2026-07-03 adversarial review — the protocol should also carry an auth field by then).
• RTP packets at the str0m input (slice-1's rtc_session.rs media ingress) — every byte str0m hands us is potentially hostile before str0m validates it; fuzz at the str0m-RtcSession boundary, not str0m internally.
• Opus decoder inputs (crates/rutster-media codec boundary) — a malicious or malformed RTP payload hits the Opus decoder. Fuzz the decoded-PCM contract (finite-length, sane amplitude range), not the decoder internals.
• Provider media-fork framing (spearhead step 5, post-ADR-0007) — the rented transport's media-fork delivers bytes that the CPaaS framed; that framing is the post-0007 equivalent of the SIP/SDP parser surface. Lands with step 5.

Slice 1 says "the browser is trusted" for the WebRTC ingress, which is correct for the signaling surface (str0m validates SDP). But the media plane accepts RTP from any peer that completed ICE, which makes the RTP/Opus surfaces above hostile-by-default regardless of signaling trust.

If you're populating this directory, replace it with:

• fuzz/Cargo.toml — cargo-fuzz manifest.
• fuzz/fuzz_targets/tap_protocol.rs — fuzz the tap protocol frame decoder.
• fuzz/fuzz_targets/rtp_packet.rs — fuzz the str0m-RtcSession RTP input.
• fuzz/fuzz_targets/opus_payload.rs — fuzz the Opus→PCM decoder boundary.
• A CI job running a short fuzz burst on each PR.

The hot-path "drop + observe, don't crash" policy (ARCHITECTURE.md Media plane; slice-4 spec §3.6) is what the harnesses assert against: throw arbitrary bytes at the surface, assert it returns an error or drops silently — never panics. A dropped packet must not terminate the peer.